Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118755Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

High 7.2

In plain English

A high-severity OS command injection in personal-management-system from Volmarg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.4%top 27.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.

Affected products (as reported)

Vendor	Product	Versions
Volmarg	personal-management-system	0 – through 2.1.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Issue #165 issue-tracking
https://github.com/Volmarg/personal-management-system product
https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Shell/ShellAbstractService.php#L55-L76 technical-description
https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Shell/ShellTreeService.php#L71-L102 technical-description
VulnCheck Advisory: Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path third-party-advisory